trellis 3.1.35 → 3.2.0

package/dist/{index-53f3b8p8.js → chunk-7QWJBS72.js}

@@ -1,13 +1,9 @@
-// @bun
 import {
   parseSimple
-} from "./index-n9f2qyh5.js";
+} from "./chunk-X46IECAC.js";
 import {
   QueryEngine
-} from "./index-yp88he8n.js";
-import {
-  __require
-} from "./index-a76rekgs.js";
+} from "./chunk-2I5JU73Y.js";
 
 // src/server/server.ts
 import { existsSync, readFileSync } from "fs";
@@ -33,13 +29,19 @@ function base64UrlDecode(input) {
   return Uint8Array.from(binary, (c) => c.charCodeAt(0));
 }
 async function hmacKey(secret) {
-  return crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign", "verify"]);
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
 }
 async function signJwt(payload, secret, expiresInSeconds = 86400) {
   const header = { alg: "HS256", typ: "JWT" };
-  const now = Math.floor(Date.now() / 1000);
+  const now = Math.floor(Date.now() / 1e3);
   const claims = { iat: now, exp: now + expiresInSeconds, ...payload };
-  const enc = new TextEncoder;
+  const enc = new TextEncoder();
   const headerB64 = base64UrlEncode(enc.encode(JSON.stringify(header)));
   const payloadB64 = base64UrlEncode(enc.encode(JSON.stringify(claims)));
   const signing = `${headerB64}.${payloadB64}`;
@@ -50,22 +52,29 @@ async function signJwt(payload, secret, expiresInSeconds = 86400) {
 }
 async function verifyJwt(token, secret) {
   const parts = token.split(".");
-  if (parts.length !== 3)
-    return null;
+  if (parts.length !== 3) return null;
   const [headerB64, payloadB64, sigB64] = parts;
-  const enc = new TextEncoder;
+  const enc = new TextEncoder();
   const signing = `${headerB64}.${payloadB64}`;
   try {
     const key = await hmacKey(secret);
     const sigRaw = base64UrlDecode(sigB64);
-    const sigBuf = sigRaw.buffer.slice(sigRaw.byteOffset, sigRaw.byteOffset + sigRaw.byteLength);
-    const valid = await crypto.subtle.verify("HMAC", key, sigBuf, enc.encode(signing));
-    if (!valid)
-      return null;
-    const claims = JSON.parse(new TextDecoder().decode(base64UrlDecode(payloadB64)));
-    const now = Math.floor(Date.now() / 1000);
-    if (typeof claims.exp === "number" && claims.exp < now)
-      return null;
+    const sigBuf = sigRaw.buffer.slice(
+      sigRaw.byteOffset,
+      sigRaw.byteOffset + sigRaw.byteLength
+    );
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      sigBuf,
+      enc.encode(signing)
+    );
+    if (!valid) return null;
+    const claims = JSON.parse(
+      new TextDecoder().decode(base64UrlDecode(payloadB64))
+    );
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof claims.exp === "number" && claims.exp < now) return null;
     return claims;
   } catch {
     return null;
@@ -157,34 +166,50 @@ async function exchangeOAuthCode(provider, code, redirectUri) {
     id: String(user.id ?? user.sub ?? ""),
     email: String(user.email ?? ""),
     name: String(user.name ?? user.login ?? ""),
-    avatarUrl: user.picture ?? user.avatar_url ?? undefined
+    avatarUrl: user.picture ?? user.avatar_url ?? void 0
   };
 }
 
 // src/server/permissions.ts
-class PermissionRegistry {
-  rules = new Map;
+var PermissionRegistry = class {
+  rules = /* @__PURE__ */ new Map();
   defaultRule = "authenticated";
+  /**
+   * Register permissions for an entity type.
+   */
   register(entityType, permissions) {
     this.rules.set(entityType, permissions);
   }
+  /**
+   * Set the fallback rule used when an entity type has no declared permissions.
+   */
   setDefault(rule) {
     this.defaultRule = rule;
   }
+  /**
+   * Get the permission rule for a specific operation on an entity type.
+   * Falls back to the default rule if not declared.
+   */
   getRule(entityType, op) {
     const def = this.rules.get(entityType);
     return def?.[op] ?? this.defaultRule;
   }
+  /**
+   * Check whether an auth context is allowed to perform an operation.
+   */
   check(auth, entityType, op, entity = null) {
     const rule = this.getRule(entityType, op);
     return evaluateRule(rule, auth, entity);
   }
+  /**
+   * Assert access — throws a PermissionError if denied.
+   */
   assert(auth, entityType, op, entity = null) {
     if (!this.check(auth, entityType, op, entity)) {
       throw new PermissionError(auth, entityType, op);
     }
   }
-}
+};
 function evaluateRule(rule, auth, entity) {
   if (rule === "public") {
     return true;
@@ -193,9 +218,10 @@ function evaluateRule(rule, auth, entity) {
     return auth.authenticated;
   }
   if (rule === "own") {
-    if (!auth.authenticated || !auth.userId)
-      return false;
-    const ownerFact = entity?.facts.find((f) => f.a === "ownerId" || f.a === "createdBy");
+    if (!auth.authenticated || !auth.userId) return false;
+    const ownerFact = entity?.facts.find(
+      (f) => f.a === "ownerId" || f.a === "createdBy"
+    );
     return ownerFact?.v === auth.userId;
   }
   if (typeof rule === "object") {
@@ -215,11 +241,7 @@ function evaluateRule(rule, auth, entity) {
   }
   return false;
 }
-
-class PermissionError extends Error {
-  auth;
-  entityType;
-  op;
+var PermissionError = class extends Error {
   constructor(auth, entityType, op) {
     const who = auth.authenticated ? `user:${auth.userId}` : "anonymous";
     super(`Permission denied: ${who} cannot ${op} ${entityType}`);
@@ -235,7 +257,7 @@ class PermissionError extends Error {
       code: 403
     };
   }
-}
+};
 var PUBLIC_READ = {
   read: "public",
   create: "authenticated",
@@ -262,19 +284,22 @@ var ADMIN_ONLY = {
 };
 
 // src/server/realtime.ts
-class SubscriptionManager {
-  clients = new Map;
+var SubscriptionManager = class {
+  clients = /* @__PURE__ */ new Map();
   pool;
   permissions;
   constructor(pool, permissions = null) {
     this.pool = pool;
     this.permissions = permissions;
   }
+  // -------------------------------------------------------------------------
+  // Client lifecycle
+  // -------------------------------------------------------------------------
   addClient(clientId, ws, auth, tenantId) {
     this.clients.set(clientId, {
       id: clientId,
       ws,
-      subscriptions: new Map,
+      subscriptions: /* @__PURE__ */ new Map(),
       auth,
       tenantId
     });
@@ -282,10 +307,12 @@ class SubscriptionManager {
   removeClient(clientId) {
     this.clients.delete(clientId);
   }
+  // -------------------------------------------------------------------------
+  // Message handling
+  // -------------------------------------------------------------------------
   async handleMessage(clientId, raw) {
     const client = this.clients.get(clientId);
-    if (!client)
-      return;
+    if (!client) return;
     let msg;
     try {
       msg = JSON.parse(raw);
@@ -306,6 +333,13 @@ class SubscriptionManager {
       return;
     }
   }
+  // -------------------------------------------------------------------------
+  // Notify — called after every mutation
+  // -------------------------------------------------------------------------
+  /**
+   * Re-evaluate all subscriptions for a given tenant and push diffs.
+   * Called after every write op lands.
+   */
   async notify(tenantId) {
     const tid = tenantId ?? null;
     const dead = [];
@@ -314,20 +348,20 @@ class SubscriptionManager {
         dead.push(clientId);
         continue;
       }
-      if (client.tenantId !== tid)
-        continue;
+      if (client.tenantId !== tid) continue;
       for (const [subId, sub] of client.subscriptions) {
-        if (sub.tenantId !== tid)
-          continue;
+        if (sub.tenantId !== tid) continue;
         await this._pushUpdate(client, sub);
       }
     }
-    for (const id of dead)
-      this.clients.delete(id);
+    for (const id of dead) this.clients.delete(id);
   }
   get clientCount() {
     return this.clients.size;
   }
+  // -------------------------------------------------------------------------
+  // Private
+  // -------------------------------------------------------------------------
   async _handleSubscribe(client, subId, queryStr, tenantId) {
     const tid = tenantId ?? client.tenantId ?? null;
     let parsedQuery;
@@ -392,9 +426,10 @@ class SubscriptionManager {
   _send(client, payload) {
     try {
       client.ws.send(JSON.stringify(payload));
-    } catch {}
+    } catch {
+    }
   }
-}
+};
 function entityId(row) {
   return String(row["?e"] ?? row.id ?? row.e ?? JSON.stringify(row));
 }
@@ -412,31 +447,20 @@ function computeDiff(prev, next) {
     }
   }
   for (const [id, row] of prevMap) {
-    if (!nextMap.has(id))
-      removed.push(row);
+    if (!nextMap.has(id)) removed.push(row);
   }
   return { added, updated, removed };
 }
 
 // src/server/server.ts
 var __moduleDir = import.meta.dir ?? dirname(fileURLToPath(import.meta.url));
-function startServer(opts) {
-  return startServerBun(opts);
-}
-async function startServerCrossRuntime(opts) {
-  if (typeof globalThis.Bun !== "undefined") {
-    const bunServer = startServerBun(opts);
-    return {
-      port: bunServer.port ?? opts.port ?? opts.config.port ?? 3000,
-      hostname: bunServer.hostname,
-      stop: (closeActive) => bunServer.stop(closeActive)
-    };
-  }
+async function startServer(opts) {
   return startServerNode(opts);
 }
+var startServerCrossRuntime = startServer;
 function buildServerContext(opts) {
   const { pool, permissions, config } = opts;
-  const port = opts.port ?? config.port ?? 3000;
+  const port = opts.port ?? config.port ?? 3e3;
   const authConfig = {
     jwtSecret: config.jwtSecret,
     apiKey: config.apiKey,
@@ -446,7 +470,10 @@ function buildServerContext(opts) {
   const handleHttp = async (req) => {
     const url = new URL(req.url);
     const path = url.pathname;
-    const auth = await resolveAuth(req.headers.get("authorization"), authConfig);
+    const auth = await resolveAuth(
+      req.headers.get("authorization"),
+      authConfig
+    );
     const tenantId = auth.tenantId ?? url.searchParams.get("tenantId") ?? null;
     try {
       return await route(req, url, path, auth, tenantId, {
@@ -467,42 +494,6 @@ function buildServerContext(opts) {
   };
   return { port, authConfig, subs, handleHttp };
 }
-function startServerBun(opts) {
-  const { port, subs, handleHttp } = buildServerContext(opts);
-  return Bun.serve({
-    port,
-    async fetch(req, server) {
-      if (req.headers.get("upgrade") === "websocket") {
-        const upgraded = server.upgrade(req, { data: undefined });
-        if (upgraded)
-          return;
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      return handleHttp(req);
-    },
-    websocket: {
-      async open(ws) {
-        const id = crypto.randomUUID();
-        ws.__clientId = id;
-        subs.addClient(id, ws, {
-          userId: null,
-          tenantId: null,
-          roles: [],
-          claims: {},
-          authenticated: false
-        }, null);
-      },
-      async message(ws, raw) {
-        const id = ws.__clientId;
-        await subs.handleMessage(id, typeof raw === "string" ? raw : new TextDecoder().decode(raw));
-      },
-      close(ws) {
-        const id = ws.__clientId;
-        subs.removeClient(id);
-      }
-    }
-  });
-}
 async function startServerNode(opts) {
   const { port, subs, handleHttp } = buildServerContext(opts);
   const { startNodeServer } = await import("./server/node-adapter.js");
@@ -513,17 +504,25 @@ async function startServerNode(opts) {
       open(ws) {
         const id = crypto.randomUUID();
         ws.__clientId = id;
-        subs.addClient(id, ws, {
-          userId: null,
-          tenantId: null,
-          roles: [],
-          claims: {},
-          authenticated: false
-        }, null);
+        subs.addClient(
+          id,
+          ws,
+          {
+            userId: null,
+            tenantId: null,
+            roles: [],
+            claims: {},
+            authenticated: false
+          },
+          null
+        );
       },
       async message(ws, raw) {
         const id = ws.__clientId;
-        await subs.handleMessage(id, typeof raw === "string" ? raw : raw.toString());
+        await subs.handleMessage(
+          id,
+          typeof raw === "string" ? raw : raw.toString()
+        );
       },
       close(ws) {
         const id = ws.__clientId;
@@ -537,7 +536,9 @@ async function route(req, url, path, auth, tenantId, ctx) {
   if (method === "GET" && path === "/__trellis/inspector.js") {
     const candidates = [
       join(__moduleDir, "db", "inspector.js"),
+      // chunk lives in dist/, inspector in dist/db/
       join(__moduleDir, "inspector.js")
+      // chunk lives in dist/db/, inspector alongside
     ];
     for (const p of candidates) {
       if (existsSync(p)) {
@@ -546,9 +547,12 @@ async function route(req, url, path, auth, tenantId, ctx) {
         });
       }
     }
-    return new Response("/* Trellis DB Inspector: run `bun run build:inspector` first */", {
-      headers: { "Content-Type": "application/javascript" }
-    });
+    return new Response(
+      "/* Trellis DB Inspector: run `bun run build:inspector` first */",
+      {
+        headers: { "Content-Type": "application/javascript" }
+      }
+    );
   }
   if (method === "GET" && path === "/__trellis/trellis.css") {
     const candidates = [
@@ -593,20 +597,16 @@ async function route(req, url, path, auth, tenantId, ctx) {
     });
   }
   if (path === "/entities" || path === "/entities/") {
-    if (method === "POST")
-      return handleCreate(req, auth, tenantId, ctx);
-    if (method === "GET")
-      return handleList(url, auth, tenantId, ctx);
+    if (method === "POST") return handleCreate(req, auth, tenantId, ctx);
+    if (method === "GET") return handleList(url, auth, tenantId, ctx);
   }
   const entityMatch = path.match(/^\/entities\/([^/]+)$/);
   if (entityMatch) {
     const id = decodeURIComponent(entityMatch[1]);
-    if (method === "GET")
-      return handleRead(id, auth, tenantId, ctx);
+    if (method === "GET") return handleRead(id, auth, tenantId, ctx);
     if (method === "PUT" || method === "PATCH")
       return handleUpdate(req, id, auth, tenantId, ctx);
-    if (method === "DELETE")
-      return handleDelete(id, auth, tenantId, ctx);
+    if (method === "DELETE") return handleDelete(id, auth, tenantId, ctx);
   }
   if (method === "POST" && path === "/query") {
     return handleQuery(req, auth, tenantId, ctx);
@@ -636,35 +636,35 @@ async function route(req, url, path, auth, tenantId, ctx) {
 }
 async function handleCreate(req, auth, tenantId, ctx) {
   const body = await req.json();
-  if (!body.type)
-    return json({ error: "type is required" }, 400);
+  if (!body.type) return json({ error: "type is required" }, 400);
   ctx.permissions?.assert(auth, body.type, "create");
   const kernel = ctx.pool.get(tenantId);
   const entityId2 = `${body.type.toLowerCase()}:${crypto.randomUUID()}`;
   const attrs = {
     ...body.attributes
   };
-  if (auth.userId)
-    attrs.createdBy = auth.userId;
-  if (auth.tenantId)
-    attrs.tenantId = auth.tenantId;
-  const result = await kernel.createEntity(entityId2, body.type, attrs, body.links);
+  if (auth.userId) attrs.createdBy = auth.userId;
+  if (auth.tenantId) attrs.tenantId = auth.tenantId;
+  const result = await kernel.createEntity(
+    entityId2,
+    body.type,
+    attrs,
+    body.links
+  );
   await ctx.subs.notify(tenantId);
   return json({ id: entityId2, op: result.op.hash }, 201);
 }
 async function handleRead(id, auth, tenantId, ctx) {
   const kernel = ctx.pool.get(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "read", entity);
   return json(entityToJson(entity));
 }
 async function handleUpdate(req, id, auth, tenantId, ctx) {
   const kernel = ctx.pool.get(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "update", entity);
   const updates = await req.json();
   await kernel.updateEntity(id, updates);
@@ -674,21 +674,22 @@ async function handleUpdate(req, id, auth, tenantId, ctx) {
 async function handleDelete(id, auth, tenantId, ctx) {
   const kernel = ctx.pool.get(tenantId);
   const entity = kernel.getEntity(id);
-  if (!entity)
-    return json({ error: "Not Found" }, 404);
+  if (!entity) return json({ error: "Not Found" }, 404);
   ctx.permissions?.assert(auth, entity.type, "delete", entity);
   await kernel.deleteEntity(id);
   await ctx.subs.notify(tenantId);
   return json({ id, deleted: true });
 }
 async function handleList(url, auth, tenantId, ctx) {
-  const type = url.searchParams.get("type") ?? undefined;
+  const type = url.searchParams.get("type") ?? void 0;
   const limit = parseInt(url.searchParams.get("limit") ?? "100");
   const offset = parseInt(url.searchParams.get("offset") ?? "0");
   const kernel = ctx.pool.get(tenantId);
   let entities = kernel.listEntities(type);
   if (ctx.permissions && type) {
-    entities = entities.filter((e) => ctx.permissions.check(auth, e.type, "read", e));
+    entities = entities.filter(
+      (e) => ctx.permissions.check(auth, e.type, "read", e)
+    );
   }
   const page = entities.slice(offset, offset + limit);
   return json({
@@ -700,8 +701,7 @@ async function handleList(url, auth, tenantId, ctx) {
 }
 async function handleQuery(req, auth, tenantId, ctx) {
   const body = await req.json();
-  if (!body.query)
-    return json({ error: "query is required" }, 400);
+  if (!body.query) return json({ error: "query is required" }, 400);
   let parsed;
   try {
     parsed = parseSimple(body.query);
@@ -735,9 +735,11 @@ async function handleFileDownload(hash, ctx, tenantId) {
   const kernel = ctx.pool.get(tenantId);
   const backend = kernel.getBackend();
   const blob = backend.getBlob(hash);
-  if (!blob)
-    return json({ error: "Not Found" }, 404);
-  const cleanBuf = blob.buffer.slice(blob.byteOffset, blob.byteOffset + blob.byteLength);
+  if (!blob) return json({ error: "Not Found" }, 404);
+  const cleanBuf = blob.buffer.slice(
+    blob.byteOffset,
+    blob.byteOffset + blob.byteLength
+  );
   return new Response(cleanBuf, {
     headers: { "Content-Type": "application/octet-stream" }
   });
@@ -764,7 +766,10 @@ async function handleRegister(req, tenantId, ctx) {
     role: "user",
     ...tenantId ? { tenantId } : {}
   });
-  const token = await signJwt({ sub: userId, email: body.email, roles: ["user"], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: userId, email: body.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId }, 201);
 }
 async function handleLogin(req, tenantId, ctx) {
@@ -787,7 +792,10 @@ async function handleLogin(req, tenantId, ctx) {
     return json({ error: "Invalid credentials" }, 401);
   }
   const role = String(roleFact?.v ?? "user");
-  const token = await signJwt({ sub: user.id, email: body.email, roles: [role], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: user.id, email: body.email, roles: [role], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId: user.id });
 }
 function handleOAuthRedirect(providerName, url, ctx) {
@@ -804,8 +812,7 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
     return json({ error: "Auth not configured (no jwtSecret)" }, 501);
   }
   const code = url.searchParams.get("code");
-  if (!code)
-    return json({ error: "Missing code" }, 400);
+  if (!code) return json({ error: "Missing code" }, 400);
   const provider = ctx.oauthProviders[providerName] ?? getBuiltinProvider(providerName, ctx);
   if (!provider)
     return json({ error: `Unknown provider: ${providerName}` }, 400);
@@ -834,51 +841,71 @@ async function handleOAuthCallback(url, providerName, tenantId, ctx) {
   } else {
     userId = users[0].id;
   }
-  const token = await signJwt({ sub: userId, email: profile.email, roles: ["user"], tenantId }, ctx.config.jwtSecret);
+  const token = await signJwt(
+    { sub: userId, email: profile.email, roles: ["user"], tenantId },
+    ctx.config.jwtSecret
+  );
   return json({ token, userId });
 }
 function getBuiltinProvider(name, ctx) {
   if (name === "google") {
     const cid = process.env.GOOGLE_CLIENT_ID;
     const csec = process.env.GOOGLE_CLIENT_SECRET;
-    if (!cid || !csec)
-      return null;
+    if (!cid || !csec) return null;
     return { ...GOOGLE_PROVIDER, clientId: cid, clientSecret: csec };
   }
   if (name === "github") {
     const cid = process.env.GITHUB_CLIENT_ID;
     const csec = process.env.GITHUB_CLIENT_SECRET;
-    if (!cid || !csec)
-      return null;
+    if (!cid || !csec) return null;
     return { ...GITHUB_PROVIDER, clientId: cid, clientSecret: csec };
   }
   return null;
 }
 async function hashPassword(password) {
   const salt = crypto.randomUUID().replace(/-/g, "");
-  const enc = new TextEncoder;
-  const keyMat = await crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits({
-    name: "PBKDF2",
-    salt: enc.encode(salt),
-    iterations: 1e5,
-    hash: "SHA-256"
-  }, keyMat, 256);
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return `${salt}:${hash}`;
 }
 async function verifyPassword(password, stored) {
   const [salt, expectedHash] = stored.split(":");
-  if (!salt || !expectedHash)
-    return false;
-  const enc = new TextEncoder;
-  const keyMat = await crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits({
-    name: "PBKDF2",
-    salt: enc.encode(salt),
-    iterations: 1e5,
-    hash: "SHA-256"
-  }, keyMat, 256);
+  if (!salt || !expectedHash) return false;
+  const enc = new TextEncoder();
+  const keyMat = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(password),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    {
+      name: "PBKDF2",
+      salt: enc.encode(salt),
+      iterations: 1e5,
+      hash: "SHA-256"
+    },
+    keyMat,
+    256
+  );
   const hash = Array.from(new Uint8Array(bits)).map((b) => b.toString(16).padStart(2, "0")).join("");
   return hash === expectedHash;
 }
@@ -898,4 +925,22 @@ function json(data, status = 200) {
   });
 }
 
-export { ANONYMOUS, signJwt, verifyJwt, resolveAuth, GOOGLE_PROVIDER, GITHUB_PROVIDER, buildOAuthUrl, exchangeOAuthCode, PermissionRegistry, PermissionError, PUBLIC_READ, FULLY_PUBLIC, OWNER_ONLY, ADMIN_ONLY, SubscriptionManager, startServer, startServerCrossRuntime };
+export {
+  ANONYMOUS,
+  signJwt,
+  verifyJwt,
+  resolveAuth,
+  GOOGLE_PROVIDER,
+  GITHUB_PROVIDER,
+  buildOAuthUrl,
+  exchangeOAuthCode,
+  PermissionRegistry,
+  PermissionError,
+  PUBLIC_READ,
+  FULLY_PUBLIC,
+  OWNER_ONLY,
+  ADMIN_ONLY,
+  SubscriptionManager,
+  startServer,
+  startServerCrossRuntime
+};